huntrule

Windows schtasks.exe Creating One-Time Scheduled Tasks Using Temp Folder

Alerts on schtasks.exe commands that create one-time scheduled tasks referencing a Temp directory.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2021-03-11
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Execution → Priv Esc

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows process creation events where schtasks.exe is used with arguments to create a scheduled task that runs once and references a Temp folder path. Attackers often use scheduled tasks for persistence or to stage execution from temporary locations to avoid drawing attention. The detection relies on process creation telemetry, matching schtasks.exe command-line parameters including the one-time schedule and a \Temp\ path.

Reporting behind it

Related detections9 linkedT1053.005 — drag to rearrange
Suspicious Scheduled Task Named WindowsHelper (via process_creation)
Scheduled Task Masquerading as Microsoft Wininet Config
Suspicious SYSTEM Scheduled Task Named test Created via schtasks
Suspicious Scheduled Task Created by Windows Script Host
Malicious CloudZ RAT Persistence via schtasks Running regasm.exe
Suspicious Scheduled Task Creation for WSPrint Persistence by UAT-9244
Malicious Scheduled Task Masquerading as GoogleUpdate Launching SSH Reverse Shell
Malicious Scheduled Task Creation TaskSystem via Interlock Ransomware
Malicious Scheduled Task Masquerading as Edge Update Running From Temp (via process_creation)
Windows schtasks.exe Creating One-Time Scheduled Tasks Using Temp Folder
Pivot detection · T1053.005 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.